From 99495eac7ec151faa2dfa2c3a55f0ae7defad51d Mon Sep 17 00:00:00 2001
From: Yufu Zhao <ms2008vip@gmail.com>
Date: Sat, 14 Sep 2024 11:10:21 +0800
Subject: [PATCH] fix(admin-api): nested parameters can be parsed correctly
 when using form-urlencoded requests

---
 .../kong/fix-parse-nested-parameters.yml         |  3 +++
 kong/api/api_helpers.lua                         |  3 ---
 kong/tools/http.lua                              |  4 +++-
 .../04-admin_api/13-plugin-endpoints_spec.lua    | 16 +++++++++++++++-
 .../kong/plugins/admin-api-method/api.lua        |  5 +++++
 5 files changed, 26 insertions(+), 5 deletions(-)
 create mode 100644 changelog/unreleased/kong/fix-parse-nested-parameters.yml

diff --git a/changelog/unreleased/kong/fix-parse-nested-parameters.yml b/changelog/unreleased/kong/fix-parse-nested-parameters.yml
new file mode 100644
index 000000000000..e1cdd3fd21e9
--- /dev/null
+++ b/changelog/unreleased/kong/fix-parse-nested-parameters.yml
@@ -0,0 +1,3 @@
+message: Fixed an issue where nested parameters can not be parsed correctly when using form-urlencoded requests.
+type: bugfix
+scope: Admin API
diff --git a/kong/api/api_helpers.lua b/kong/api/api_helpers.lua
index 69e9822a8ede..b6361132ee28 100644
--- a/kong/api/api_helpers.lua
+++ b/kong/api/api_helpers.lua
@@ -298,9 +298,6 @@ local function parse_params(fn)
 
         if is_json and not self.json then
           return kong.response.exit(400, { message = "Cannot parse JSON body" })
-
-        elseif find(content_type, "application/x-www-form-urlencode", 1, true) then
-          self.params = decode_args(self.params)
         end
       end
     end
diff --git a/kong/tools/http.lua b/kong/tools/http.lua
index 58e5bb908b5e..344c2a6f3f21 100644
--- a/kong/tools/http.lua
+++ b/kong/tools/http.lua
@@ -141,6 +141,8 @@ do
   end
 
 
+  -- { ["1"] = "a", ["2"] = "b" } becomes {"a", "b"}
+  -- { "a", "b" }  becomes { "a", "b" }
   local function decode_array(t)
     local keys = {}
     local len  = 0
@@ -160,7 +162,7 @@ do
       if keys[i] ~= i then
         return nil
       end
-      new_t[i] = t[tostring(i)]
+      new_t[i] = t[tostring(i)] or t[i]
     end
 
     return new_t
diff --git a/spec/02-integration/04-admin_api/13-plugin-endpoints_spec.lua b/spec/02-integration/04-admin_api/13-plugin-endpoints_spec.lua
index 24a4c7af8dd1..bdd637ffde4c 100644
--- a/spec/02-integration/04-admin_api/13-plugin-endpoints_spec.lua
+++ b/spec/02-integration/04-admin_api/13-plugin-endpoints_spec.lua
@@ -38,9 +38,23 @@ describe("Admin API endpoints added via plugins #" .. strategy, function()
       path = "/method_without_exit",
       headers = { ["Content-Type"] = "application/json" }
     })
-    local body = assert.res_status(201 , res)
+    local body = assert.res_status(201, res)
     assert.same("hello", body)
   end)
+
+  it("nested parameters can be parsed correctly when using form-urlencoded requests", function()
+    local res = assert(client:send{
+      method = "POST",
+      path = "/parsed_params",
+      body = ngx.encode_args{
+        ["items[1]"] = "foo",
+        ["items[2]"] = "bar",
+      },
+      headers = { ["Content-Type"] = "application/x-www-form-urlencoded" }
+    })
+    local body = assert.res_status(200, res)
+    assert.same('{"items":["foo","bar"]}', body)
+  end)
 end)
 
 end
diff --git a/spec/fixtures/custom_plugins/kong/plugins/admin-api-method/api.lua b/spec/fixtures/custom_plugins/kong/plugins/admin-api-method/api.lua
index 73c42b11cf9c..69e2ab165e33 100644
--- a/spec/fixtures/custom_plugins/kong/plugins/admin-api-method/api.lua
+++ b/spec/fixtures/custom_plugins/kong/plugins/admin-api-method/api.lua
@@ -6,4 +6,9 @@ return {
       ngx.print("hello")
     end,
   },
+  ["/parsed_params"] = {
+    POST = function(self, db, helpers, parent)
+      kong.response.exit(200, self.params)
+    end,
+  },
 }